Federal Deposit
Insurance Corporation

Upon the recommendation of the Federal Financial Institutions Examination Council, the FDIC Board of Directors has adopted the attached "Interagency Policy Statement on External Auditing Programs of Banks and Savings Associations." It replaces the FDIC's "Statement of Policy Regarding Independent External Auditing Programs of State Nonmember Banks" and is effective for fiscal years beginning on or after January 1, 2000. The other banking agencies have also adopted the interagency policy statement.

Section 36 of the Federal Deposit Insurance Act requires insured institutions with $500 million or more in total assets to have an external audit of their financial statements. Therefore, the interagency policy statement is primarily directed to institutions not subject to section 36.

As discussed more fully in the attached Federal Register notice, both the interagency policy statement and the rescinded FDIC policy statement encourage institutions to adopt an annual external auditing program and, where practicable, to establish an audit committee composed entirely of outside directors. In an external auditing program, an independent auditor performs procedures to test and evaluate high risk areas of a bank's business and reports the results of the work to the bank.

The interagency policy statement states that the banking agencies consider an annual audit of an institution's financial statements performed by an independent public accountant to be the preferred type of external auditing program. The statement also describes two alternatives to a financial statement audit that an institution may elect to have performed annually in order to have an acceptable external auditing program. These alternatives, which must be performed by an independent public accountant, are (1) an attestation on internal control over financial reporting on certain schedules of the Reports of Condition and Income (Call Report) or (2) an audit of the institution's balance sheet. The policy statement further indicates that, for a smaller institution with less complex operations, the attestation on internal control may be less costly than an audit of its financial statements or its balance sheet and provide more useful information to management.

The policy statement recognizes that some institutions only have agreed-upon procedures or state-required examinations performed annually as their external auditing program. Nevertheless, the policy statement reminds boards of directors that they are responsible for ensuring that the external auditing program is appropriate for their institution and adequately addresses the financial reporting aspects of the significant risk areas and any other areas of concern in the institution's business.

The policy statement also instructs institutions to provide copies of reports pertaining to the external auditing program to the banking agencies and any state authority. The FDIC continues to request that state nonmember banks submit these reports to their appropriate regional office and state authority.

Please share this information with the appropriate personnel in your institution. For further information, please contact the regional accountant in your FDIC regional office.